This is because when you include a $ in your yaml it needs to be escaped:

You can use a $$ (double-dollar sign) when your configuration needs a literal dollar sign. This prevents Drone from interpolating a value, so a $$ allows you to refer to environment variables that you don’t want processed by Drone.

Also, if I understand your post correctly, you are also trying to run this from command line with drone exec (if I misunderstood, you can ignore this). When you run your pipeline locally you need to pass your secrets to drone exec. The drone exec command does not have any access to secrets stored in the drone server.